Privacy Policy

The controller of your personal data is [REGISTERED COMPANY NAME — TO BE CONFIRMED], registered at [REGISTERED ADDRESS — TO BE COMPLETED] (“we”, “us”). For any privacy question, or to exercise the rights described in section 10, contact us at [privacy@your-domain — TO BE COMPLETED].

This policy is published in English. Translations of the interface are provided for convenience; in the event of any conflict, the English version of this policy governs.

We collect only what the service needs to run, settle competitions, and stay compliant.

We do not collect or store your payment card details or your wallet’s private keys. We do not sell personal data, and we do not use it for third-party advertising.

Deposits and withdrawals settle in USDC on the Polygon network. Anything recorded on a public blockchain — including wallet addresses, amounts, and transaction hashes — is public, permanent, and outside our control. We cannot edit, delete, or anonymise it, and neither can you.

Because blockchain activity is publicly linkable, a wallet address you connect here may be associated with your other on-chain activity by third parties. Consider this before connecting a wallet you use elsewhere.

We use a deliberately small set of cookies, and none for advertising:

• Session cookie — keeps you signed in. Strictly necessary; httpOnly, so it cannot be read by scripts in your browser.
• Language cookie — remembers your chosen language for one year.
• Theme — your light/dark preference, stored in your browser’s local storage and never sent to us.

Our analytics provider collects aggregate, privacy-preserving usage measurements (such as page views and performance timings) and does not use cross-site advertising cookies.

We share data only with service providers that process it on our instructions, under contract, for the purposes below. We do not sell personal data.

We may also disclose data where legally required — to regulators, law enforcement, or in response to valid legal process — and to establish, exercise, or defend legal claims.

Our providers may process data outside your country, including in the United States and the European Economic Area. Where data leaves the UK/EEA, transfers are made under an adequacy decision or Standard Contractual Clauses with appropriate safeguards. You can request details of the safeguards that apply by contacting us.

Financial and competition records are retained for as long as required by financial, audit, and anti-money-laundering obligations, and to resolve disputes — typically several years after your last activity, and longer where the law requires it.

This has an important consequence: we do not hard-delete accounts, transactions, games, or entries. When you ask us to erase your data, we anonymise the personal identifiers attached to your records (such as your username and email) while retaining the underlying financial and competition entries in a form that no longer identifies you.

Each record of your acceptance of the Terms of Service and this policy, including the IP address and browser user agent it was sent from, is kept as part of the compliance record for as long as the financial and competition records above. If you ask us to erase your data, we remove the IP address and user agent from these records and keep only the version accepted, your age confirmation, and the date and time.

Operational data with no long-term purpose — move timings, rate-limit counters, and failed login counters — is deleted automatically on a rolling basis, typically within hours.

Some decisions are made automatically: anti-cheat systems may flag play patterns consistent with engine assistance, and access to deposits, entries, or withdrawals may be restricted automatically based on your jurisdiction or verification status.

Where such a decision significantly affects you — for example suspending an account or blocking a withdrawal — you have the right to request human review, to express your point of view, and to contest the outcome. Contact us at [privacy@your-domain — TO BE COMPLETED].

Depending on where you live, you may have the right to: access a copy of your data; correct inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; and withdraw consent where processing relies on it. These rights are subject to the retention limits described in section 8.

If you are in California, you additionally have the right to know what personal information is collected, disclosed, or sold; to request deletion; to correct inaccurate information; and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email [privacy@your-domain — TO BE COMPLETED]. We will respond within the period required by applicable law (one month under the GDPR; 45 days under the CCPA) and may need to verify your identity first. If you believe we have handled your data improperly, you may complain to your local data protection authority.

Passwords are stored only as salted bcrypt hashes. Sessions use httpOnly cookies. Traffic is encrypted in transit, and access to production data is restricted. Balance changes are written atomically alongside an immutable ledger entry, so financial history cannot be silently altered.

No system is perfectly secure. Use a strong, unique password, and tell us immediately at [privacy@your-domain — TO BE COMPLETED] if you suspect unauthorised access to your account.

Corgi Chess is not intended for anyone under 18. We do not knowingly collect data from children. If we learn that we hold data belonging to someone under 18, we will suspend the account and delete the personal data we are permitted to delete.

We may update this policy as the service evolves. We will change the effective date above and, where changes are material, notify you in the application or by email before they take effect.